001/*
002 * Copyright 2002-2016 the original author or authors.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *      https://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 */
016
017package org.springframework.web.filter;
018
019import java.io.IOException;
020import javax.servlet.FilterChain;
021import javax.servlet.ServletException;
022import javax.servlet.http.HttpServletRequest;
023import javax.servlet.http.HttpServletResponse;
024
025import org.springframework.util.Assert;
026import org.springframework.web.cors.CorsConfiguration;
027import org.springframework.web.cors.CorsConfigurationSource;
028import org.springframework.web.cors.CorsProcessor;
029import org.springframework.web.cors.CorsUtils;
030import org.springframework.web.cors.DefaultCorsProcessor;
031import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
032
033/**
034 * {@link javax.servlet.Filter} that handles CORS preflight requests and intercepts
035 * CORS simple and actual requests thanks to a {@link CorsProcessor} implementation
036 * ({@link DefaultCorsProcessor} by default) in order to add the relevant CORS
037 * response headers (like {@code Access-Control-Allow-Origin}) using the provided
038 * {@link CorsConfigurationSource} (for example an {@link UrlBasedCorsConfigurationSource}
039 * instance.
040 *
041 * <p>This is an alternative to Spring MVC Java config and XML namespace CORS configuration,
042 * useful for applications depending only on spring-web (not on spring-webmvc) or for
043 * security constraints requiring CORS checks to be performed at {@link javax.servlet.Filter}
044 * level.
045 *
046 * <p>This filter could be used in conjunction with {@link DelegatingFilterProxy} in order
047 * to help with its initialization.
048 *
049 * @author Sebastien Deleuze
050 * @since 4.2
051 * @see <a href="https://www.w3.org/TR/cors/">CORS W3C recommendation</a>
052 */
053public class CorsFilter extends OncePerRequestFilter {
054
055        private final CorsConfigurationSource configSource;
056
057        private CorsProcessor processor = new DefaultCorsProcessor();
058
059
060        /**
061         * Constructor accepting a {@link CorsConfigurationSource} used by the filter
062         * to find the {@link CorsConfiguration} to use for each incoming request.
063         * @see UrlBasedCorsConfigurationSource
064         */
065        public CorsFilter(CorsConfigurationSource configSource) {
066                Assert.notNull(configSource, "CorsConfigurationSource must not be null");
067                this.configSource = configSource;
068        }
069
070
071        /**
072         * Configure a custom {@link CorsProcessor} to use to apply the matched
073         * {@link CorsConfiguration} for a request.
074         * <p>By default {@link DefaultCorsProcessor} is used.
075         */
076        public void setCorsProcessor(CorsProcessor processor) {
077                Assert.notNull(processor, "CorsProcessor must not be null");
078                this.processor = processor;
079        }
080
081
082        @Override
083        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
084                        FilterChain filterChain) throws ServletException, IOException {
085
086                if (CorsUtils.isCorsRequest(request)) {
087                        CorsConfiguration corsConfiguration = this.configSource.getCorsConfiguration(request);
088                        if (corsConfiguration != null) {
089                                boolean isValid = this.processor.processRequest(corsConfiguration, request, response);
090                                if (!isValid || CorsUtils.isPreFlightRequest(request)) {
091                                        return;
092                                }
093                        }
094                }
095
096                filterChain.doFilter(request, response);
097        }
098
099}